AI literacy

In plain English

Think of driver's education. You don't need to be a mechanic to drive safely. You do need to know the rules, how the car behaves on ice and when to brake. AI literacy is the same for AI. It is not coding. It is knowing enough to use AI tools sensibly, spot a hallucination or a biased output, and know what data must never go in.

Different roles need different depth. A board member needs to understand AI risk appetite. A recruiter needs to know how AI can discriminate in hiring. A person reviewing AI outputs needs to recognize automation bias and know when to override.

Example

Penrose Logistics, a fictional EU distributor with 1,800 staff, uses a generative AI assistant and a vendor's route-planning tool. It builds its program in five steps:

1. It maps who uses AI, who oversees it and who is affected by it.
2. It sets a 45-minute baseline for everyone, including contractors who use its tools. The baseline covers what AI is, hallucinations, the acceptable use policy and how to report a problem.
3. It adds role modules. Dispatchers who review AI routes learn about automation bias and overrides. Procurement learns AI due diligence. The board gets a session on risk appetite and oversight.
4. It keeps records of who completed what, and tests understanding instead of counting completions.
5. It refreshes content whenever tools, policies or laws change.

This is the kind of proportionate measure the current Art. 4 describes. Penrose does not certify that each person reaches a set proficiency level, and the law does not ask it to.

Why it matters

The EU AI Act defines AI literacy in Art. 3(56). It means the skills, knowledge and understanding needed for informed use of AI and awareness of its opportunities, risks and harms.

• Scope: Art. 4 covers providers and deployers of all AI systems, not only high-risk ones. It has applied since 2 Feb 2025.
• The 2026 rewrite: the Digital Omnibus (Regulation (EU) 2026/1744, in force 27 Jul 2026) replaced Art. 4. Providers and deployers now "take measures to support the development of AI literacy" of their staff and others acting on their behalf. The old duty to "ensure, to their best extent, a sufficient level" is gone. The new text expressly does not require them to guarantee any specific level for any individual.
• Support: under the new Art. 4(2), the Commission and Member States must support providers and deployers, especially SMEs. The Commission publishes practical examples.
• Standards: ISO/IEC 42001 separates competence (clause 7.2) from awareness (clause 7.3). The NIST AI RMF expects personnel and partners to receive AI risk management training (GOVERN 2.2).

How the AIGP exam tests it

The BoK asks for training and awareness for all stakeholders (lesson I.B.3), and Art. 4 appears with deployer duties (lesson II.C.6).

Common traps:

• Scope. "Applies only to high-risk systems" or "only to developers" is false. Deployers of any AI system are covered.
• Date. It applied from 2 Feb 2025, alongside the prohibitions, not from 2 Aug 2026.
• Old wording. Answers saying organizations must guarantee a sufficient level for every person reflect the pre-Omnibus text.
• Technical staff only. Risk arises wherever AI outputs are used, so training must reach business users too.
• Completion rates as proof. Attendance is not understanding.

The tell: an organization-wide baseline, deeper role-based modules, records and regular refreshes.